Server vulnerability detection method and system

Abstract

The application provides a kind of server hidden danger detection method and system, method includes: the predicted future time period and the current performance index data of the server to be detected are input into target multi-time sequence prediction model, obtain the target performance index data of the server to be detected in future time period;Target performance index data is input into target regression model, and the target power data of the server to be detected in future time period is obtained;According to target power data, determine whether the server to be detected has hidden danger.The application uses multi-time sequence prediction model to obtain the time sequence characteristics of the performance index data of server, uses regression model to analyze the correlation between the performance index data and power data of server.Through predicting the performance index data of future server, and through regression model, the power data of future server is calculated based on predicted performance index data to carry out the hidden danger identification of server, can better identify hidden danger, reach the effect of timely warning.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method and system for detecting server vulnerabilities. Background Technology

[0002] With the popularization of cloud technology, especially the demand for "new infrastructure" and "digital transformation" driving the rapid development of the digital economy, the deployment scale of servers in data centers has also grown exponentially. Consequently, the complexity and difficulty of operation and maintenance management have increased significantly. The fault operation of traditional massive server data centers faces greater challenges and higher costs. From the initial script-based and tool-based operations and maintenance to platform-based operations and maintenance, manpower has reached its limits and is increasingly unable to meet the requirements of quickly repairing faults and restoring business operations.

[0003] Currently, most methods for identifying potential server vulnerabilities rely solely on time-series prediction. This involves using historical server data to build a time-series prediction model that forecasts changes in a given indicator over a future period, then comparing the predicted values ​​with predefined thresholds to determine if any vulnerabilities exist. This approach makes vulnerability identification dependent on the historical time-series characteristics of the data, which fails to capture potential future anomalies and achieve timely early warnings. Summary of the Invention

[0004] The server vulnerability detection method and system provided by this invention are used to solve the problem that the identification of server vulnerabilities in the prior art relies on the historical time sequence characteristics of data, which makes it impossible to capture possible future anomalies and achieve the effect of timely early warning.

[0005] This invention provides a server vulnerability detection method, comprising:

[0006] The predicted future time period and the current performance index data of the server to be detected are input into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0007] The target performance index data is input into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0008] Based on the target power data, determine whether the server under test has any hidden dangers.

[0009] According to a server vulnerability detection method provided by the present invention, the step of determining whether the server to be detected has any vulnerabilities based on the target power data includes:

[0010] If the target power data exceeds the power overload threshold range, it is determined that the server under test has a potential problem. The power overload threshold range is determined based on the mean and standard deviation of the current performance index data.

[0011] According to a server vulnerability detection method provided by the present invention, the acquisition methods of the first performance index data and the first power data include:

[0012] The historical performance index data and historical power data of the server under test are cleaned.

[0013] The first performance index data and the first power data are obtained by standardizing the historical performance index data and historical power data after data cleaning based on the standard score method.

[0014] According to a server vulnerability detection method provided by the present invention, the method for obtaining the second performance indicator data includes:

[0015] Perform an F-test on each performance index data in the first performance index data to obtain the p-value and f-value corresponding to each performance index data.

[0016] Based on the p-value and the f-value, obtain the score for each performance indicator data;

[0017] The second performance index data is determined based on a predetermined number of performance index data with the highest scores in the first performance index data.

[0018] According to a server vulnerability detection method provided by the present invention, the method for obtaining the optimal parameters of the multi-time-series prediction model and the optimal parameters of the regression model includes:

[0019] Based on the grid search algorithm, the parameters to be optimized in the multi-time series prediction model are optimized to obtain the optimal parameters of the multi-time series prediction model;

[0020] Based on the grid search algorithm, the parameters to be optimized in the regression model are optimized to obtain the optimal parameters of the regression model.

[0021] According to a method for detecting server vulnerabilities provided by the present invention, the server to be detected includes a computing server and a storage server.

[0022] This invention also provides a server vulnerability detection system, comprising:

[0023] The first prediction module is used to input the predicted future time period and the current performance index data of the server to be detected into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0024] The second prediction module is used to input the target performance index data into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0025] The hazard detection module is used to determine whether there are any hidden dangers in the server to be tested based on the target power data.

[0026] The present invention also provides an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the server vulnerability detection method described above.

[0027] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the server vulnerability detection method as described above.

[0028] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the server vulnerability detection method described above.

[0029] The server vulnerability detection method and system provided by this invention uses a multi-time-series prediction model to obtain the time-series characteristics of server performance index data, and uses a regression model to analyze the correlation between server performance index data and power data. By predicting future server performance index data and using a regression model to calculate future server power data based on the predicted performance index data, vulnerability identification can be improved, achieving timely early warning. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0031] Figure 1 This is a flowchart illustrating the server vulnerability detection method provided by the present invention;

[0032] Figure 2 This is a schematic diagram of the server vulnerability detection system provided by the present invention;

[0033] Figure 3 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0035] Server problems often have warning signs, namely drastic changes in certain metrics, such as excessively high or low values. For example, server power consumption is correlated with CPU utilization, average fan speed percentage, and average CPU temperature. Excessively high temperatures, utilization, and fan speeds indicate potential server overload. Analyzing the correlation between performance metrics and potential problem indicators allows for better identification of problems and timely warnings.

[0036] Based on this, the server vulnerability detection method provided by the present invention includes obtaining indicator data (including performance indicator data and power data) of the server to be detected through sensors, preprocessing the data (including data cleaning and data standardization), training a multi-time series prediction model such as neural-prophet using the performance indicator data, performing feature engineering on the preprocessed performance indicator data, training a regression model (e.g., XGBoost regression model) using the reconstructed performance indicator data and the preprocessed power data, predicting the performance indicator data in future time periods, and calculating the power data in future time periods to identify server vulnerabilities. The specific implementation is as follows:

[0037] Figure 1 This is a flowchart illustrating the server vulnerability detection method provided by the present invention, as shown below. Figure 1 As shown, the method includes:

[0038] Step 110: Input the predicted future time period and the current performance index data of the server to be detected into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0039] Step 120: Input the target performance index data into the target regression model to obtain the target power data of the server to be detected within the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0040] Step 130: Based on the target power data, determine whether the server under test has any hidden dangers.

[0041] It should be noted that the above method can be implemented by computer equipment.

[0042] Optionally, the current performance metric data can specifically be the performance metric data of the server under test at the current moment, which can be acquired through sensors.

[0043] The target multi-time series prediction model is obtained by training the model by inputting the first performance index data of the server under test and the optimal parameters of the multi-time series prediction model. Specifically, the multi-time series prediction model can be neural-prophet. The first performance index data can be obtained by preprocessing the historical performance index data of the server under test. This historical performance index data can be performance index data within a historical time period, or it can be acquired through sensor data collection.

[0044] When training the multi-time series prediction model neural-prophet, different prediction time period parameters can be set for neural-prophet to adjust the future time period predicted by the trained target multi-time series prediction model. For example, if the prediction time period parameter of neural-prophet is set to January 15, 2020 to January 22, 2020 during training, the future time period that the trained target multi-time series prediction model can predict is from the current time (i.e., the start date of the prediction) to the end time. The end time can be obtained by adding 7 days to the current time.

[0045] After obtaining the trained target multi-time series prediction model, the future time period predicted by the target multi-time series prediction model is set, and the performance index data of the server to be detected at the current time is input into the multi-target prediction model. Based on the output of the multi-time series prediction model, the performance index data of the server to be detected in the future time period is predicted, that is, the target performance index data.

[0046] Optionally, the target regression model can be specifically obtained by training the regression model after inputting the second performance index data of the server under test, the first power data of the server under test, and the optimal parameters of the regression model. The second performance index data can be obtained by feature engineering the first performance index data of the server under test, and the first power data can be obtained by preprocessing the historical power data of the server under test. The historical power data can be the power data of the server under test within a historical time period, which can be acquired through sensor collection. The regression model can be XGBoost.

[0047] The predicted performance metrics of the server to be tested for a future time period are input into the target regression model. Based on the output of the target regression model, the functional data of the server to be tested for a future time period, i.e., the target power data, is predicted.

[0048] Based on the target power data of the server to be tested within a future time period, a security vulnerability detection is performed on the server to be tested to determine whether there are any potential vulnerabilities.

[0049] The server vulnerability detection method provided by this invention uses a multi-time-series prediction model to obtain the time-series characteristics of server performance index data, and uses a regression model to analyze the correlation between server performance index data and power data. By predicting future server performance index data and using a regression model to calculate future server power data based on the predicted performance index data, vulnerability identification can be improved, achieving timely early warning.

[0050] Furthermore, in one embodiment, determining whether the server under test has potential risks based on the target power data may specifically include:

[0051] If the target power data exceeds the power overload threshold range, it is determined that the server under test has a potential problem. The power overload threshold range is determined based on the mean and standard deviation of the current performance index data.

[0052] Optionally, the predicted start and end dates (including year, month, and day information) and the current performance index data of the server to be tested are input into the target multi-time series prediction model to predict the target performance index data for the future time period, and the predicted target performance index data are input into the target regression model to calculate the target power data ω of the server to be tested for the future time period.

[0053] Calculate the mean η and standard deviation μ of the current power data, and then calculate the power overload threshold range (η-2×μ, η+2×μ) based on the mean η and standard deviation μ. If the target power data ω exceeds this power overload threshold range (i.e., ω>η+2×μ, or ω<η-2×μ), then the server under test will experience power overload in the future, posing a potential risk. Otherwise, there is no potential risk.

[0054] Furthermore, in one embodiment, the server to be detected includes a computing server and a storage server.

[0055] Optionally, the server to be tested can be specifically a computing server and a storage server.

[0056] For computing servers, it is necessary to collect performance index data and power data of computing servers through sensors. The performance index data of computing servers includes: server CPU utilization, server memory size, server memory utilization, file system utilization, average fan speed percentage, and average CPU temperature, a total of 6 performance index data; the power data of computing servers includes the current power consumption.

[0057] For storage servers, it is necessary to collect performance index data and power data of storage servers through sensors. The performance index data of storage servers includes: used capacity of distributed block storage cluster, capacity utilization rate, capacity allocation rate of distributed block storage cluster, read rate of distributed block storage pool, write rate of distributed block storage pool, capacity utilization rate of distributed block storage pool, capacity allocation rate of distributed block storage pool, and cache utilization rate of distributed block storage pool, totaling 8 performance index data. The power data of storage servers includes the current power consumption.

[0058] Furthermore, in one embodiment, the method for obtaining the first performance index data and the first power data may specifically include:

[0059] The historical performance index data and historical power data of the server under test are cleaned.

[0060] The first performance index data and the first power data are obtained by standardizing the historical performance index data and historical power data after data cleaning based on the standard score method.

[0061] Optionally, the historical performance index data and historical power data of the acquired computing or storage server are cleaned. Specifically, if any field in the historical index data and historical power data of the computing or storage server has a missing value, then that data will not be used to train the multi-time series prediction model and regression model.

[0062] The cleaned data is standardized using the z-score method to obtain the first performance index and first power data. The mean and standard deviation of the cleaned data are calculated. Each cleaned data point is subtracted from its mean and divided by its standard deviation to ensure the data conforms to a standard normal distribution. This reduces the influence of the dimensions of the performance index and power on the weight calculation. The standardized data will be used for time series forecasting and regression analysis.

[0063] Furthermore, in one embodiment, the method for obtaining the second performance index data may specifically include:

[0064] Perform an F-test on each performance index data in the first performance index data to obtain the p-value and f-value corresponding to each performance index data.

[0065] Based on the p-value and the f-value, obtain the score for each performance indicator data;

[0066] The second performance index data is determined based on a predetermined number of performance index data with the highest scores in the first performance index data.

[0067] Optionally, feature engineering is performed on the obtained first performance index data of the computing or storage server to identify a preset number, e.g., n, of optimal performance index data for subsequent regression analysis. Specifically:

[0068] After data preprocessing, the next step is often to train the regression model. However, selecting more meaningful features (i.e., performance metrics data) to input into the regression model for training can both improve the training speed and the prediction accuracy. Since the task involves regression prediction, feature selection needs to be based on the correlation between the performance metrics data and power data from the computing or storage server. Features with high correlation contribute more to the regression prediction.

[0069] The F-test is performed on each feature of the computing or storage server using a filtering method, calculating the p-value and f-value for each performance metric. The F-test is primarily used to test the significance of differences between the means of two or more samples. The F-test outputs the f-value and p-value for each performance metric. The f-value indicates whether the relationship between the performance metric and power data is significant; a larger f-value indicates a stronger correlation. The p-value is an indicator of the reliability of the result; a larger p-value indicates a less reliable result. If p = 10%, there is a 10% chance that the correlation between the performance metric and power data is due to chance. Each performance metric is scored by combining the f-value and p-value; the higher the f-value and the smaller the p-value, the higher the score.

[0070] For computing or storage servers, a predetermined number of performance indicators with the highest scores can be selected from the corresponding primary performance indicator data and used as the secondary performance indicator data for regression analysis. For example, setting n=4 means selecting the top 4 primary performance indicator data with the highest scores. For storage servers, setting n=6 means selecting the top 6 primary performance indicator data with the highest scores.

[0071] The server vulnerability detection method provided by this invention improves the training speed and prediction accuracy of the regression model by performing feature engineering on the preprocessed data and selecting more meaningful features to input into the regression model for training.

[0072] Furthermore, in one embodiment, the method for obtaining the optimal parameters of the multi-time-series prediction model and the optimal parameters of the regression model may specifically include:

[0073] Based on the grid search algorithm, the parameters to be optimized in the multi-time series prediction model are optimized to obtain the optimal parameters of the multi-time series prediction model;

[0074] Based on the grid search algorithm, the parameters to be optimized in the regression model are optimized to obtain the optimal parameters of the regression model.

[0075] Optionally, the parameters to be optimized in the multi-time-series prediction model neural-prophet are optimized based on a grid search algorithm, and the optimal parameters of neural-prophet are calculated. Specifically:

[0076] A grid search model was built, and the parameters to be optimized for neural-prophet were set as follows: the number of iterations (epochs) was set to a search range of [100, 200, 3000], the batch size (batch_size) was set to a search range of [16, 32, 64, 128], the learning rate (learning_rate) was set to a search range of [0.01, 0.001, 0.0001], the loss function (loss_func) was set to a search range of ["Huber", "MSE", "MAE"], and the number of hidden layers (num_hidden_layers) was set to a search range of [1, 2, 3, 5]. After the search, the optimal parameters were obtained: epochs = 100, batch_size = 64, learning_rate = 0.001, loss_func = MSE, and num_hidden_layers = 2. The optimal parameters of neural-prophet and the first performance index data of the server to be tested were input into neural-prophet for training.

[0077] The parameters to be optimized in the regression model XGBoost are optimized based on the grid search algorithm, and the optimal parameters of XGBoost are calculated. Specifically:

[0078] A grid search model is built, and the parameters to be optimized for XGBoost are set as follows: the search range for the maximum tree depth max_depth is set to [3, 5, 10, 15], the search range for the maximum number of iterations n_estimators is set to [100, 200, 300, 500], the search range for the learning rate learning_rate is set to [0.01, 0.001, 0.0001], the search range for the L1 regularization term reg_alpha of the weights is set to [0.001, 0.002, 0.003, 0.005], the search range for the random sampling ratio subsample of each tree is set to [0.7, 0.8, 0.9], and the search range for the column sampling ratio colsample_bylevel of each node split of each tree is set to [0.7, 0.8, 0.9]. The search concluded, yielding the optimal parameters: max_depth = 15, n_estimators = 200, learning_rate = 0.001, reg_alpha = 0.005, subsample = 0.8, and colsample_bylevel = 0.8. The optimal parameters of xgboost, the second performance metric data of the server under test, and the first power data of the server under test were then input into the xgboost regression model for training.

[0079] The objective function Obj of xgboost is:

[0080]

[0081] Where: L is the loss function, N is the number of base learners, and F... m-1 (x i f is the output of the (m-1)th base learner. m (x i ) is the output of the m-th base learner. This is a regularization term. A greedy node splitting strategy is adopted, and the reward function Gain for node splitting is:

[0082]

[0083]

[0084] Wherein: g i h is the first derivative of the objective function. i G is the second derivative of the objective function, I(j) is all the samples contained in node j, and G is the second derivative of the objective function. L It is the left node's g i The sum, G R It is the right node's g i The sum, HL h is the left node i The sum, H R h is the right node i The sum of γ is a penalty term that allows nodes to be skipped if the splitting benefit is too small, and λ is the balance parameter of the regularization term.

[0085] The server vulnerability detection method provided by this invention uses the optimal parameters of the model to train the model, which can further improve the training speed and prediction accuracy of the model.

[0086] The server vulnerability detection system provided by the present invention is described below. The server vulnerability detection system described below can be referred to in correspondence with the server vulnerability detection method described above.

[0087] Figure 2 This is a schematic diagram of the server vulnerability detection system provided by the present invention, as shown below. Figure 2 As shown, it includes:

[0088] The first prediction module 210 is used to input the predicted future time period and the current performance index data of the server to be detected into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0089] The second prediction module 211 is used to input the target performance index data into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0090] The hazard detection module 212 is used to determine whether there are any hidden dangers in the server to be detected based on the target power data.

[0091] The server vulnerability detection system provided by this invention uses a multi-time-series prediction model to obtain the time-series characteristics of server performance index data, and uses a regression model to analyze the correlation between server performance index data and power data. By predicting future server performance index data and using the regression model to calculate future server power data based on the predicted performance index data, the system can better identify vulnerabilities and achieve timely early warning.

[0092] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as... Figure 3 As shown, the electronic device may include a processor 310, a communication interface 311, a memory 312, and a bus 313, wherein the processor 310, the communication interface 311, and the memory 312 communicate with each other via the bus 313. The processor 310 can call logical instructions in the memory 312 to execute the following methods:

[0093] The predicted future time period and the current performance index data of the server to be detected are input into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0094] The target performance index data is input into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0095] Based on the target power data, determine whether the server under test has any hidden dangers.

[0096] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer power supply (which may be a personal computer, server, or network power supply, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0097] Furthermore, this invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when these instructions are executed by a computer, the computer can execute the server vulnerability detection methods provided in the above-described method embodiments, such as including:

[0098] The predicted future time period and the current performance index data of the server to be detected are input into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0099] The target performance index data is input into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0100] Based on the target power data, determine whether the server under test has any hidden dangers.

[0101] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the server vulnerability detection methods provided in the above embodiments, including, for example:

[0102] The predicted future time period and the current performance index data of the server to be detected are input into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected.

[0103] The target performance index data is input into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected.

[0104] Based on the target power data, determine whether the server under test has any hidden dangers.

[0105] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0106] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer power supply (which may be a personal computer, server, or network power supply, etc.) to execute the methods described in various embodiments or some parts of the embodiments.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting server vulnerabilities, characterized in that, include: The predicted future time period and the current performance index data of the server to be detected are input into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected. The target performance index data is input into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected. Based on the target power data, determine whether the server under test has any hidden dangers; The step of determining whether the server under test has potential risks based on the target power data includes: If the target power data exceeds the power overload threshold range, it is determined that the server under test has a potential problem. The power overload threshold range is determined based on the mean and standard deviation of the current power data. The methods for obtaining the optimal parameters of the multi-time-series prediction model and the optimal parameters of the regression model include: Based on the grid search algorithm, the parameters to be optimized in the multi-time series prediction model are optimized to obtain the optimal parameters of the multi-time series prediction model; Based on the grid search algorithm, the parameters to be optimized in the regression model are optimized to obtain the optimal parameters of the regression model; The servers to be tested include computing servers and storage servers; the historical performance metrics of the computing servers include server CPU utilization, server memory size, server memory utilization, file system utilization, average fan speed percentage, and average CPU temperature; the historical performance metrics of the storage servers include: used capacity of the distributed block storage cluster, capacity utilization, capacity allocation rate of the distributed block storage cluster, read rate of the distributed block storage pool, write rate of the distributed block storage pool, capacity utilization rate of the distributed block storage pool, capacity allocation rate of the distributed block storage pool, and cache utilization rate of the distributed block storage pool.

2. The server vulnerability detection method according to claim 1, characterized in that, The methods for obtaining the first performance index data and the first power data include: The historical performance index data and historical power data of the server under test are cleaned. The first performance index data and the first power data are obtained by standardizing the historical performance index data and historical power data after data cleaning based on the standard score method.

3. The server vulnerability detection method according to claim 1, characterized in that, The methods for obtaining the second performance index data include: Perform an F-test on each performance index data in the first performance index data to obtain the p-value and f-value corresponding to each performance index data. Based on the p-value and the f-value, obtain the score for each performance indicator data; The second performance index data is determined based on a predetermined number of performance index data with the highest scores in the first performance index data.

4. A server vulnerability detection system, characterized in that, include: The first prediction module is used to input the predicted future time period and the current performance index data of the server to be detected into the target multi-time series prediction model to obtain the target performance index data of the server to be detected within the future time period. The target multi-time series prediction model is obtained by training the multi-time series prediction model by inputting the first performance index data and the optimal parameters of the multi-time series prediction model into the multi-time series prediction model. The first performance index data is obtained by preprocessing the historical performance index data of the server to be detected. The second prediction module is used to input the target performance index data into the target regression model to obtain the target power data of the server to be detected in the future time period. The target regression model is obtained by training the regression model by inputting the second performance index data, the first power data and the optimal parameters of the regression model into the regression model. The second performance index data is obtained by performing feature engineering processing on the first performance index data. The first power data is obtained by preprocessing the historical power data of the server to be detected. The hazard detection module is used to determine whether there are any hidden dangers in the server to be detected based on the target power data. The hazard detection module is specifically used for: If the target power data exceeds the power overload threshold range, it is determined that the server under test has a potential problem. The power overload threshold range is determined based on the mean and standard deviation of the current power data. The methods for obtaining the optimal parameters of the multi-time-series prediction model and the optimal parameters of the regression model include: Based on the grid search algorithm, the parameters to be optimized in the multi-time series prediction model are optimized to obtain the optimal parameters of the multi-time series prediction model; Based on the grid search algorithm, the parameters to be optimized in the regression model are optimized to obtain the optimal parameters of the regression model; The servers to be tested include computing servers and storage servers; the historical performance metrics of the computing servers include server CPU utilization, server memory size, server memory utilization, file system utilization, average fan speed percentage, and average CPU temperature; the historical performance metrics of the storage servers include: used capacity of the distributed block storage cluster, capacity utilization, capacity allocation rate of the distributed block storage cluster, read rate of the distributed block storage pool, write rate of the distributed block storage pool, capacity utilization rate of the distributed block storage pool, capacity allocation rate of the distributed block storage pool, and cache utilization rate of the distributed block storage pool.

5. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the server vulnerability detection method according to any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the server vulnerability detection method as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the server vulnerability detection method as described in any one of claims 1 to 3.

Images